Safety Case vs Risk Register vs Decision Memo: Which Fits?

A board can receive three polished documents about the same hazard and still lack the evidence needed to make a safe decision. The problem is not always poor analysis. Often, the organization selected the wrong document for the question it needs to answer.

A safety case explains why a major-hazard system is tolerable and how its controls depend on one another. A risk register keeps exposures, owners, and treatment actions visible across the portfolio. A decision memo asks an authorized leader to choose, fund, defer, or reject a defined course of action. They overlap, but they do not perform the same governance job.

The useful comparison is not which document is best in general. It is which document creates the clearest evidence for the decision the board must make now.

Why the document choice changes the quality of a board decision

Board discussions become vague when the evidence is detached from the decision. A risk register may show that a hazard is open, yet it may not explain why the control set is credible. A safety case may explain the control logic, yet it may not show which budget choice is blocking progress. A decision memo may recommend an option, yet it may hide the assumptions that make the recommendation safe.

This distinction matters because risk is managed through choices, not through paperwork. Andreza Araujo's book Sorte ou Capacidade frames the same principle in practical terms: organizations should manage risk with method rather than rely on luck. The board therefore needs a document that makes the method visible, including its limits, owner, evidence, and expiry point.

When the format is wrong, the meeting can still look disciplined. Leaders review slides, ask for updates, and record an approval. The exposure remains poorly understood because the evidence never matched the decision.

Evaluation criteria for choosing the right format

Use five questions before deciding which document should reach the board. The first asks whether the decision concerns one major-hazard system or a portfolio of varied exposures. The second asks whether the board must understand control dependencies or simply prioritize action. The third asks who owns the next decision and what authority that person holds.

The fourth question concerns evidence maturity. If control performance has not been verified in the field, a polished argument can create false confidence. The fifth asks how quickly the decision may change. A document that remains useful after conditions move is different from one that records a single approval.

These criteria separate three common needs:

• demonstrating that a major-hazard system has a defensible control argument;
• maintaining an enterprise view of exposures, owners, and overdue treatment;
• making one time-bound decision traceable to evidence, options, and authority.

Safety case: use it when control logic must be demonstrated

A safety case is strongest when the board needs to understand how a high-consequence system is supposed to remain controlled. It connects hazards, preventive barriers, mitigations, operating assumptions, verification activities, and emergency arrangements into one argument. The document is valuable because it exposes dependencies that a list of risks may leave separate.

For example, a process facility may state that overpressure protection, inspection, alarm response, and emergency isolation keep a release scenario within tolerable bounds. The safety case should show what each layer does, which evidence confirms its availability, and what happens when one layer is unavailable. It should also identify the conditions under which the argument no longer applies.

The board should choose this format when the question sounds like, “Why should we believe this system is controlled?” The answer must be more than a risk score. It needs a defensible chain from the initiating hazard to the consequence, through the barriers that are expected to interrupt that path.

A safety case becomes weak when it is written once for approval and then left untouched. Its credibility depends on current evidence, which means the organization must connect it to control verification, management of change, maintenance information, and field conditions. If the argument cannot survive a changed operating mode, it is an archive, not assurance.

Risk register: use it when exposure must be governed across the portfolio

A risk register is the better tool when leaders need a consistent view of multiple exposures across plants, projects, or business units. It can show the risk owner, affected operation, current controls, treatment plan, target date, residual assessment, and escalation status. That shared structure helps a board compare unlike risks without pretending they are identical.

The register answers a different question from the safety case. It asks, “Where is exposure concentrated, who owns the next action, and what is drifting?” That makes it useful for portfolio governance, especially when budget, staffing, or capital allocation must be prioritized across competing needs.

Its main weakness is compression. A row can show that a control exists while concealing whether workers can rely on it during the actual task. A green residual score can also survive after assumptions have changed. The register should therefore link high-consequence entries to evidence such as inspection results, overdue maintenance, field verification, or a current safety case.

Andreza's position that an identified risk must be eliminated or controlled, with doing nothing unavailable as an option, is a useful test for register quality. An entry without a live owner, a treatment decision, or a review trigger is not governance. It is a record of concern.

Decision memo: use it when one choice needs accountable approval

A decision memo is strongest when a leader must choose between defined options. It should state the decision requested, the current exposure, the alternatives considered, the evidence supporting each option, the consequences of delay, and the authority required to approve the path forward.

The memo is not a shorter risk register. It is a focused bridge between analysis and action. A board may use it to approve funding for engineered protection, accept a temporary residual exposure with an expiry date, stop a project until a control is verified, or assign a decision to an operating executive.

Its central danger is recommendation bias. If the memo begins with a preferred option and treats the other choices as obstacles, the board may approve a conclusion without examining the risk. The author should show the assumptions behind each option and identify which evidence would change the recommendation.

Use a decision memo when the meeting must end with a clear answer. The decision should name the owner, the conditions of approval, the review date, and the evidence that will confirm whether the choice worked. Without those fields, the memo records permission but not accountability.

Decision matrix: match the tool to the question

The matrix does not mean that one document should replace the others. A major project may need a safety case as the technical argument, a risk register as the portfolio view, and a decision memo for the capital request that closes a control gap. The mistake is asking one format to perform all three jobs without preserving the evidence each job requires.

Recommendation by context

Choose the safety case first when the board is reviewing a major-hazard operation whose control dependencies are difficult to see. Choose the risk register first when the board is comparing exposures across sites or deciding where limited resources should go. Choose the decision memo first when a specific approval, rejection, funding choice, or temporary acceptance is blocking action.

Some situations require a sequence. Start with the safety case to establish whether the control argument is credible. Record the exposure and ownership in the risk register so the issue remains visible across governance cycles. Then use a decision memo when the next step requires authority, budget, or a time-bound exception.

That sequence is more disciplined than sending three documents to the board and expecting directors to assemble the logic themselves. It also creates a better link between technical assurance and executive accountability.

What to verify before the board meeting

Before the meeting, ask whether each document contains evidence that can be checked outside the authoring team. A control claim should have a verification source. A risk owner should have decision rights and resources. A recommendation should disclose the consequence of delay and the condition that would force a new review.

Compare the proposed material with the site's decision threshold questions and its risk appetite boundaries. If the exposure is high consequence, also test whether the organization has accumulated verification debt that makes a green status unreliable.

The final check is simple but demanding. Can a director state what decision is required, what evidence supports it, who owns the next move, and when the choice must be revisited? If not, the document has not yet made the risk governable.

FAQ

Can a risk register replace a safety case?

Usually not. A risk register organizes exposure across the portfolio, while a safety case explains why a major-hazard system is controlled and what assumptions support that claim. The register can point to the safety case, but it should not compress the control argument into a single row.

When should a board request a decision memo?

Request one when the board must approve, reject, fund, defer, or time-limit a defined option. The memo should make the decision explicit and show the consequences of delay, rather than simply repeat the current risk description.

What makes a safety case credible?

A credible safety case connects hazards to barriers, states its assumptions, identifies evidence for control availability, and explains what changes would invalidate the argument. It should be updated when operations, equipment, staffing, or emergency arrangements change.

Should all three documents use the same risk score?

They may share definitions, but they should not depend on the score alone. The safety case needs barrier evidence, the risk register needs ownership and treatment status, and the decision memo needs options and authority. A common score does not create common evidence.

What is the first step for a safety leader?

Write the board question in one sentence before choosing the document. If the question is about control logic, start with a safety case. If it is about portfolio exposure, start with a risk register. If it is about a choice that needs approval, start with a decision memo.

Andreza Araujo's practical lesson is direct: risk is not managed by naming it, and a board is not protected by receiving more pages. The organization must choose the evidence format that makes the next decision clear, owned, and testable.

For more practical guidance on safety culture and risk management, explore the Headline Podcast blog.